HighPublic exploit

Unix Account with Default, Null, Blank, or Missing Password

IdentifiersCVE-1999-0502CWE-258

CVE-1999-0502 describes a condition in which a Unix account is configured with a default, null, blank, or otherwise missing password. This is an authentication weakness rather than a memory corruption or software logic flaw in a specific function. The vulnerable condition exists when the account authentication configuration permits login without a properly set secret, or with a well-known default credential state, allowing password-based access to the account.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

An attacker who can reach an authentication interface for the affected Unix account may be able to authenticate without knowing a legitimate user-chosen password, resulting in unauthorized access to the account. Depending on the privileges of the affected account, this can expose sensitive data, permit local or remote shell access, enable privilege escalation through misconfigured administrative accounts, and provide a foothold for further lateral movement or persistence.

Mitigation

If you can’t patch tonight, do this now.

Where immediate remediation is not possible, restrict access to authentication services through network segmentation, host-based firewalls, and allowlists. Disable remote login for affected accounts, require key-based or centralized authentication where possible, and enforce policies that reject empty passwords. Monitor authentication logs for successful logins to accounts that should not permit passwordless or default-password access, and lock or expire unused accounts.

Remediation

Patch, then assume compromise.

Set a strong, unique password for every Unix account and disable or lock any account that does not require interactive authentication. Remove default credentials, enforce password initialization during provisioning, and review PAM, shadow password, and account management settings to ensure blank or null passwords are not accepted. Audit all local and network-accessible accounts for empty password fields or default credential states, and rotate any credentials that may have been exposed or left in insecure default configurations.

PUBLIC EXPLOITS

Exploits

1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (24 hidden).

VALID 1 / 25 TOTALView more in app

sshexec.rbMaturityWeaponizedFrameworkmetasploitVerified exploit

This repository contains a single Metasploit module: 'modules/exploits/multi/ssh/sshexec.rb'. The module is designed to exploit systems accessible via SSH by leveraging weak or known credentials (CVE-1999-0502). It supports a wide range of platforms, including Linux, OSX, BSD, Unix, and Python-enabled systems. The exploit works by authenticating to the target SSH server using provided credentials and then executing arbitrary commands or payloads, which can include reverse shells, command stagers, or interactive SSH sessions. The module is highly weaponized, allowing for flexible payload delivery and session management. The only fingerprintable endpoint is the SSH service, typically on TCP port 22, but the port is configurable. The code is structured as a standard Metasploit exploit module, with options for username, password, target host, and port, and includes advanced options for SSH debugging. The exploit is not a detection script or a fake; it is a fully operational code execution module for post-authentication SSH access.

Disclosed Jan 1, 1999rubynetwork

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

Hewlett Packard EnterpriseHp-Uxoperating_system

Red HatLinuxoperating_system

SunSolarisoperating_system

SunSunosoperating_system

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

2 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.

2 SOURCESView more in app

No news coverage yet. Advisories and community discussion only.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity2